CVE-2018-5178

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51797.5A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by uCVE-2018-51807.5A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability iCVE-2018-51817.5If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open aCVE-2018-51827.5If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specifCVE-2018-51839.8Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer CVE-2018-51847.5Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51856.5Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51869.8Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort thaCVE-2018-51879.8Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that witCVE-2018-51889.8Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and CVE-2018-51897.8Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flipCVE-2018-51909.8PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified coo